{"apiVersion":"1.0","identifier":"CVE-2026-70461","description":"rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer.","publishedAt":"2026-08-13T15:20:00","lastModifiedAt":"2026-08-26T17:01:33","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70461","cvssScore":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","epssProbability":0.00509,"riskScore":0.86,"affectedProduct":"rsync","affectedVersions":"<3.5.0","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-70461","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-70461","en":"https://www.redsauce.net/en/cves/CVE-2026-70461","fr":"https://www.redsauce.net/fr/cves/CVE-2026-70461","pt":"https://www.redsauce.net/pt/cves/CVE-2026-70461","de":"https://www.redsauce.net/de/cves/CVE-2026-70461","sk":"https://www.redsauce.net/sk/cves/CVE-2026-70461","el":"https://www.redsauce.net/el/cves/CVE-2026-70461"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-70461"}}